Excess
Virus.DOS.Excess.3529 or Excess is a destructive virus that runs on MS-DOS. Behavior When the virus is being loaded into memory, it first prints "Hello, World", and then it starts to infect .COM and .EXE files that are executed. The virus behaves stealthily so that there is no observable size change to infected files and free memory space. Payload The virus payload is very similar to that of Casino. It activates when the system timer lands on an obscure memory address (but in danooct1's video, the virus date condition has been modified by FlightCPUBoy, to Tuesdays) while executed by playing three short beeps and printing a (threat) message: DANGER! You are infected by ExCESS Virus © 1995 The Nuker I have destroyed your FATs but I only have one copy in my data area. IF YOU REBOOT NOW ALL YOUR DATA WILL BE LOST. If this isn't enough, I have altered your Master Boot Record with a formatting routine in order to low-level format the primary Hard Disk when executed. If you are so dude and you don't believe me, reboot now and look at your hard disk light spinning... If you don't want to loose all your data then try to guess a number from 0 to 9 and pray for your answer to be correct, else... Then the virus starts a "guess a number" game. The user has three chances to guess the correct number chosen by the virus. To make the game harder, the virus changes the correct number for every guess. If the user wins (27.1% chance), the virus will print explicit message, swearing to the user: (the actual message is not censored) You f**king SH*T!!! You guessed the right number!!! You are safe this time but next will come very soon and you will not be so lucky!!! Note the sublte English usage in this message. After the user win the game, the main virus command process will terminated, and (sometimes) finds for infected background progress exist in memory. If it does, then the virus re-runs the routine. But in this case, if the user lose the game, it prints a fake win message (to calm down the user from being threatened): Hum.. you are lucky this time... Please wait while reconstructing disk structure... Then the virus display a real loading screen - which is actually progress of the virus wipe out the hard disk and overwrite the MBR with the virus' routine. When it's done, the virus plays three short beep again and displays its final message: (the actual message is not censored) I WAS JOKING!!! Your Hard Disk has been f**ked up!!! Thank you for choosing another product of... -T-h-e- -N-u-k-e-r- After this message printed, the system is totally halted from this point, and the keyboard input is also disabled. The user must perform a hard reset in order to reboot the computer, but the machine will stuck on CMOS, since the whole hard disk has been removed completely by the virus itself. Category:DOS virus Category:Virus Category:DOS Category:TSR